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While it is usually known that the mean value of a single observable is enough to detect entan- 
glement or its distillability, the counterpart of such an approach in the case of quatum privacy has 
been missing. Here we develop the concept of a privacy witness, i.e. a single observable that may 
detect presence of the secure key even in the case of bound entanglement. Then we develop the 
notion of secret key estimation based on few observables and discuss the witness decomposition into 
local measurements. The surprising property of the witness is that with the help of a low number 
of product mesurements involved it may still report the key values that are strictly above distillable 
entanglement of the state. For an exemplary four-qubit state studied in a recent experiment [K. 
Dobek et al, Phys. Rev. Lett. 106, 030501 (2011)] this means 6 Pauli operator product mea- 
surements versus 81 needed to carry out the complete quantum state tomography. The present 
approach may be viewed as a paradigm for the general program of experimentally friendly detection 
and estimation of task-dedicated quantum entanglement. 

PACS numbers: 03.67.Lx, 42.50.Dv 



I. INTRODUCTION 

Entanglement based cryptography [l|, equivalent for- 
mally to the BB84 scheme 0], is the one that uses the 
power of quantum entanglement monogamy obeyed by a 
maximally entangled pure quantum state. If the state is 
noisy then in some cases it is possible to run an entangle- 
ment distillation process Q which may be interpreted as 
quantum privacy amplification [3| . Since the final output 
is maximally entangled, it may be used directly for secret 
key generation. The efficiency of this procedure is quanti- 
fied with distillable entanglement Ed, which defines how 
many singlet states can be obtained in the asymptotic 
regime per one input. 

Still it was known that certain states which cannot be 
prepared by local operations and classical communication 
(LOCC) are not distillable, exhibiting the phenomenon 
of bound entanglement For a long time bound en- 
tanglement was believed to be useless for cryptography, 
but several years ago it was shown 0] , that at least 
some bound entangled states may be useful in quantum 
cryptography. This is one extreme instance of the gen- 
eral fact that the amount of distillable secure key 
may exceed the amount of distillable singlets Ed. The 
latter effect has been verified in a recent experiment Q. 

The key ingredient in the complete theory of distilling 
a secret key from quantum states @, 0] is the notion of 
a private bit, p-bit — or more generally a private dit, p- 
dit — which is a delocalized maximally entangled state 
that still retains some entanglement monogamy result. A 
quantum p-dit is composed from a key part AB, and 
the shield part A'B', shared between Alice (subsystems 



AA') and Bob (subsystems BB') in such a way that the 
local von Neumann measurements on the key part in a 
particular basis will make its results completely statisti- 
cally uncorrelated from the results of any measurement 
of an eavesdropper Eve on her subsystem E, which is 
a part of the purification |^)aba'B'b of the p-dit state 
QABA'B' ■ There is a nice explanation how the shield part 
protects the statistics of the measurement on A and B to 
be correlated to Eve: it just makes it impossible to dis- 
tinguish the results of the measurement by an external 
observer. 

An obvious way to determine privacy properties is 
to reconstruct tomographically the complete p-dit state 
QABA'B'- This however is a very time consuming pro- 
cess, especially if the system under investigation is high- 
dimensional. The aim of the present paper is to give 
bounds on the distillable secure key based just on few 
observables. This advances further the study presented 
in Ref. [9] , where it was proposed to carry out a tomog- 
raphy of the so-called privacy-squeezed state of the state 
of merit. We demonstrate that a single observable suf- 
fices to provide a nontrivial bound. We also provide more 
accurate estimates based on two observables. These re- 
sults provide tools for application-specific detection of 
entanglement, refining the fundamental concept of the 
entanglement witness proposed in [l^l and [ll| that can 
be also subjected to optimization with respect to local 
measurements 1 ^ 1 3| and used to quantify the amount 



of entanglement [i4lll5j . 

The present results can be viewed as an outcome of a 
more general research program: experimentally friendly 
detection/ estimation of task- dedicated quantum entangle- 
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ment and/ or correlations. In fact it is quite usual that 
we are interested in that aspect of entanglement which is 
useful for specific quantum information task. The quan- 
tity characterizing this aspect may be a monotone but 
we believe that it need not to be in general. For in- 
stance it is known that there are cases when specific Bell 
inequalities which are important for device independent 
cryptography are better violated by nonmaximally entan- 
gled states. In this context we believe that the present 
paradigm will lead to systematic development of exper- 
imentally friendly detection/estimation of resources for 
quantum information tasks. 

This paper is organized as follows. In Sec.|ll]we elab- 
orate on lower bounds on distillable entanglement and 
distillable key. In Sec. IIIII we present a lower bound on 
distillable key in terms of single parameter, i.e. single pri- 
vacy witness. An approximate version of this bound is 
presented in Appendix. In Sec. IIVI we discuss how to in- 
fer privacy of a noisy state from the expectation values 
of two observables. Finally, Sec. IVl concludes the paper. 



II. KEY BOUNDS 

Let us start by reviewing how an individual observable 
can be used to estimate distillable entanglement Eo- The 
most natural observable in this context is a projector 



We, 



|*max) (*r, 



(1) 



maximally entangled state j^'i. 



onto a 

-^Yl'i=i\^i) A ® |V'i)-B of two d-level systems, where 
{|0i}A} and {IV'i)^} are any two orthonormal bases. 
Following the idea of Ref. [3] dealing with the case 
d = 2, there is a protocol for an arbitrary d such that 
\i F{qab) = Tr(WcnteAs) = (^maxlgyisl^max) Satisfies 
F{gAB) > 2 then the state qab is distillable 16]. 

The corresponding rate of the distillation protocol can 
be easily estimated from below by the hashing protocol 
[itI fisj l which gives an estimate for the distillable entan- 
glement as 



Ed{qab) > S{gB) - SIqab) 



(2) 



where S{-) denotes the von Neumann entropy. 

Since an application of the so-called U ®U* twirling 
[l6j can only decrease distillable entanglement Eu we 
may twirl the state qab in order to bring it to a highly 
symmetric form and then apply the hashing inequality 
^ which eventually gives: 



EdVqab) > \og2d-H{ F, 



1 - F 



1 - F 



(3) 



where F = F{qab) and H{{pi}) = - Y.iPi^'^&2Pi is the 
Shannon entropy. 

The above formula is valid for any bipartite quantum 
state QAB- There are more sophisticated twirling proto- 
cols. For instance for two qubits there is a protocol fT§| 



utilizing selected random Pauli operations that brings the 
state to a form diagonal in the Bell basis: 



(4) 



where \ are Bell states. Applying the hashing protocol 
to Q^^ leads to: 



Ed{QAb) > 1 - H{pi,p2,P3,Pi)- 



(5) 



Eqs. ^ and ^ provide bounds on the key rate for qab, 
as distilled singlet states can be used for the standard 
Ekert protocol. In general however, this may be not the 
most efficient way to generate the key. 

As pointed out in the introduction, a straighforward 
way to verify that we have a p-bit or a state close to 
p-dit enough that the secret key may be distilled. It is 
based on the so-called quantum state tomography which 
allows to calculate specific entropic functions that can 
be used to estimate the amount of the secret key from 
below. A useful quantity is the Devetak- Winter function 
^DW which quantifies the secret key distillable through 
a specific one-way secret key distillation protocol: 



Kd{qaba'B') > Kdw{qaba'B')- 



(6) 



The Devetak- Winter function is given explicitly by the 
difference of two Holevo quantities xab and xae which 
characterize the amount of information that can be re- 
covered respectively by Bob and Eve from subsystems B 
and E after Alice carried out a von Neumann measure- 
ment of the subsystem A in the secure basis {1*)^}: 



KDwiOABA'B') = XAB {^'^EQ'abe) ' XAE (Trsg^^^^J^) 



The state Q^abe given by: 



(7) 



Oabe = Tr^'B' {\i)a{^ ® ^A'BB'e) 

X \'i')AA'BB'E (^1 (N) A (^1 ^ ^A'BB'e) ] ■ (8) 



Let us now restrict our attention to a situation when 
the key part is composed of two qubits A and B. The 
complete density matrix qab A' B' can be written as a 4 x 4 
array of blocks Aij,ki = AB{ij\QABA'B'\kl)AB- 



QABA'B' 



/^00,00 ^00,01 ^00,10 ^oo,ii\ 

^01,00 ^01,01 ^01,10 ^01,11 

^10,00 ^10,01 ^10,10 ^10,11 

\^ii,oo j4ii^oi ^11,10 ^11,11/ 



(9) 



It can be transformed by LOCC (with respect to the 
partition AA' : BB') to the form: 
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Q 



^5(^o.oo + ^l,ll) . . ^ . 

5(^01,01+^1040) 5(^01,10+^10,01) 

5(^01,10 + ^10,01) 5(^01,01+^10,10) 
V5(^o,ii +^i,oo) 5(^00,00 + ^1,11)/ 



5(^00,11 + ^ii,oo)\ 





(10) 



Which can be ,,unwistcd" to Bell diagonal matrix which is directly related to privacy squeezed state (see f?!, I9I]): 



/5ll^00,00 + ^11, 111 




\5P00,11 +^11 ,00 1 











^11^01,01 + ^10,lo|| ^11^01,10 + ^10,0l|| 

511^01,10 + ^io,oi|| 511^01,01 + ^io,io|| 











I An 



I An 



^ii,ooll\ 



^l,llll/ 



(11) 



where the norm 1 1 • 1 1 stands for the trace norm. 
It will be convenient to write uab hi the form: 

l\{Vl+P2) i(pi~P2)\ 

. _ Up^+Pi) Up3~P4) 

|(P3-P4) |(P3+P4) 

\UPl-P2) \{P1+P2)) 

(12) 

It is easy to see that (tab is diagonal in the Bell basis 
and the parameters pi are occupation probabilities of the 
corresponding Bell states. 

There is a useful bound on the secret key which is [9] 

Kd{qabA'B') > IcM : B) - S{aAB) 

= I - h{pi + P2) - H{pi,p2,P3,P4) (13) 

Here Ici{A : B) is the classical mutual informa- 
tion for the outcomes of von Neumann measurements 
carried out by Alice and Bob in the secure basis 
|00)ab, |01)ab, |10)ab, |11)as- As the joint probability 
distribution for these outcomes is {5(^1 + P2), \ {P3 + 
Pi)i \{p-i + Pi), \{pi + P2)}, we have Ici{A : B) = I - 
h{pi + P2), where h{x) = —x log2 x — {1 — x) log2(l — a;) 
denotes the binary entropy. 

Note that the bound given in Eq. ((T5)) is weaker than 
that on distillable entanglement in Eq. ([S]). This is be- 
cause the state (tab does not actually describe the phys- 
ical system at any stage of the protocol, but is rather a 
formal construct characterizing privacy properties of the 
state QABA'B' of the complete system ABA'B' . 

III. SINGLE PRIVACY WITNESS 

The class of secrecy witnesses we shall consider here is 
defined formally as 

W-kcy = (111)^5(001 + |00)ab(11|) ® Ua'B' 

= [a'A®cT'g-a\®al)®UA'B- (14) 

where Ua'B' is any hermitian matrix satisfying WU < 1 
acting on the shield subsystems A' and B'. 



We will use the expectation value of the secrecy witness 
(Wkey) to approximate the value of pi — p2. In fact we 
have: 

w := \{Wkcy)\ = Tr[(ioo,ii +iii,oo)?>] 

< 11^00,11 +^11, ool I = Pi -P2 (15) 

since for any matrix satisfying WU < 1 one has 
Tt{AU) < \ \A\\. Indeed, U^IJ < 1 implies \\U\\^ < 1 and 
consequently TiAu <||iC/||<||A||-||?7||oo- Sometimes 
the parameter w may give exactly the value of pi — P2- 
We will give an instance of that at the end of this sec- 
tion. Let us also stress that the witness itself (|14p is an 
observable which must be measured on the original state 
®. 

Quantitative estimation of the distillable key will be 
based on the following inequality 

H{pi,P2,P3,P4) < H {pi,p2, 5(1 -Pi -P2), 1(1 ~Pi -P2)) 

(16) 

applied to Eq. p^ . which yields: 

KD>l-h(pi+p2) 

-H{pi,p2,\{l-Pi-P2),\{l-Pi-P2))- (17) 

As we are interested in the most pessimistic scenario, we 
need to minimize the right hand side over pairs (pi,P2) 
that satisfy all the constraints. This gives the central 
formula: 

Kd >1- sup [h{pi +P2) 

Pl,P2>0,pi+p2<l 

+ i^ (pi,P2,5(l-Pi-P2),5(l-Pi -P2))] (18) 

We found numerically the boundary value w* at which 
the above bound becomes strictly positive, i.e. the wit- 
ness condition w = |(VPkoy)| > w* , to be equal to 
w* w 0.907. 

We can simplify the optimization in Eq. (jl8l) by in- 
troducing a new pair of variables p+ = Pi + P2 and 
^+ = pi/{pi +P2)- A straightforward calculation shows 
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that the bound for the key expressed in the new variables 
takes the form: 



Kd > 



inf 

■w<.p-^ < 1 
(to+p+)/2p+<C+<l 



{p+-2hip+)-p+h{^+)). (19) 



Because the lower limit for ^+ is greater or equal to 
1/2, optimization over for a fixed value of p-^- yields 
/i(^_i_) < -|-p-|_)/2p-|_). Consequently, the minimiza- 
tion in Eq. ([19]) needs to be carried out over a single 
parameter p+ : 

Kd> inf [p+-2hip+)-p+h{{w+p+)/2p+)]. (20) 

w<p^<l 

The absolute minimum of this expression is analyzed in 
Appendix. However we can simplify the bound in two 
ways leading to weaker but more compact formulas: 

Weaker bound 1: Suppose that w > (1 — k;)/3 which 
is equivalent to w > 1/4. Then we have the following 
estimate: 

Kd>1- h{w) - H {w, i(l - w), i(l - w), i(l - w)) 

(21) 

In the last inequality we have used the fact that both 
Pi + P2 > w and pi > w. 

Weaker bound 2: There is a possibility of having an- 
other bound with help of subadditivity of the entropy 

H[pi,p2,P3,P4] < h{pi +P2) + h{pi +J33)- 

(22) 



Kd>1- 2h{w) - /i (i(l + w)) 



For a graphic comparison of the derived formulas see 
Fig. [11 




FIG. 1: Graphs of lower bounds on the distillable key as a 
function of w = |{W^priv)| derived in Eqs. (|18|l (solid line), 
([2TJ (dashed line), and ([ggj (dotted line). 



The above considerations are based on the ccq sce- 
nario, when Alice and Bob measure their qubits in 
the secure key basis |0), |1). However if the shield 
part is not affected by local unitary the optimal If re- 
mains unchanged. For instance, in the case of the 
four-qubit state whose approximate version was realized 
experimentally in Ref. 8], a two-qubit swap operator 
Va'B' — ^A'B' ~ '^l'^ -) A' B' ^^^"^ ™ privacy wit- 
ness would give exactly the value |(Wpriv)| = Pi — P2- 
Note also that if U were not hermitian, we could de- 
compose U — Ur + iUi and measure two observables 
= (|11).4b(00| + |00)ab(11|) » Ur and ^ 



R _ 



key 



IV. TWO-OBSERVABLE PRIVACY 
ESTIMATION 

In this section we will show how to characterize the 
privacy properties of a noisy entangled state from expec- 
tation values of two observables. The first one, given by 
(T^ eg) (t|j (g) 1a' b' , characterizes correlations between mea- 
surements performed on the subsystems A and B in the 
key basis. The security of the key will be inferred using 
the expectation value of an observable ct^ ® fr^j (8> Ua' b' ■ 

In the further discussion it will be convenient to use 
the following parameterization of aAB ■ 



f^AB 








P 









P+(e+ - ^)\ 
p-(e--l) 
i) ip_ 

hp+ J 

(23) 

The nonnegative parameters p+ = pi + P2 and p_ — 
1 — p+ = P3+P4: can be interpreted as occupation proba- 
bilities of the correlated and the anticorrelated subspaces, 
spanned respectively by pairs or vectors |00)as, |11)as 
and |01)ab, |10)yiB- The other two parameters, given 
explicitly by ^+ = Pi/p+ and ^_ = pzjp-, character- 
ize the off-diagonal elements of a ab respectively in the 
correlated and the anticorrelated sectors and therefore 
contain information about the privacy properties. Be- 
cause the off-diagonal elements of gab are nonnegative 
due to the definition given in Eq. (|11[) and must ensure 
positive definiteness of uab , the parameters ^_ , ^+ sat- 
isfy the inequality: 



^<^+,e- <i, 



(24) 



i.e. the relevant region for pairs (^_ , ^-|_) has the shape of 
a square. 

In the new parameterization, the lower bound on the 
key takes the following form: 



Ku>\- 2h{p+)-p+h{i+)-p-h{i,). 



(25) 



(|ll)Ai3(00| + |00)AB(ll|) «)[//. 



Because the binary entropies /i(C-(-) and h{^-) are non- 
negative, a necessary condition for this bound to be non- 
trivial is h{p+) < i, otherwise the right hand side is 
not positive. This means that p+ must satisfy either 
< p+ < 1 — p* or p* < p+ < 1, where p* w 0.89 is 
the bigger of two solutions of a transcedental equation 
h{p*) — ^ on the interval < p* < 1. We will restrict 
our further discussion only to the case p* < p-\- < 1, 
as the analysis of the second case < p+ < 1 — p* is 
completely analogous. 

Let us now discuss how the parameters of gab are 
related to measured observables. The parameters p± can 
be evaluated directly from the measured observables as 
p± — 5 (1 ± ((7^ (g) (Tg ® i^'B')). Following discussion 
after Eq. (|25p . we will be interested in the regime when 
p^ > p* ■ Considering the other regime when p^ < 1 — 
p* effectively boils down to swapping the roles of the 
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correlated and the anticorrelated subspaces. These two 
possibihties can be analyzed jointly by defining 



and using in further discussion 



1 



P± 



(26) 



(27) 



The condition > p* can be equivalently written as 

> 2p* - 1 « 0.78 (28) 

which defines the minimum value of Wz above which the 
bound on the key can become nontrivial. 

The second quantity we will use in our analysis will be 



•Ua' 



(29) 



It allows us to bound the parameters ^_ and ^+ according 
to the following inequality which will be at the heart of 
our reasoning: 

= |Tr[C/(^oo,ii + ^01,10 + ^10,01 + ^ii,oo)]| 

< 11^00,11 + ^ll.Ooll + 11^01,10 + ^lO.Olll 

= p+(2e+-l)+p-(2e_-l). (30) 

For fixed p±, this inequality determines the allowed re- 
gion of (C-,f+) in the square defined by Eq. (p4|) as 



P 



(31) 



When evaluating the lower bound on the key rate Kjj 
according to Eq. (^5]) we are interested in the worst case 
scenario that is consistent with the measurement results. 
Therefore our task is to minimize the right hand side of 
Eq. (|25|) under constraints given by Eqs. (|24l) and (|3T1) . 
This is equivalent to maximizing under the same con- 
straints a concave function 

f{^-,M=P-HU+P+hiM- (32) 

The lower bound on the key can be written as 

Kd>1~ 2h{p+) - /--^ (33) 

where f^^^ is the maximum of /(C-)C+) over the al- 
lowed region of parameters. It is useful to note that be- 
cause /(^_,^-|_) is a convex linear combination of binary 
entropies /i(C-) f^nd /i(^+), within the square given by 
Eq. ([M)) decreasing either of the arguments ^_ or will 
always increase the value of f{^-,^+). This in turn im- 
plies that f"^'^^ is reached on the line 



P 



(34) 



To proceed with the maximization, let us start from 
an observation that if ^+ = ^, i.e. the correlated sector 
of the density matrix has zero off-diagonal elements, no 
positive key rate can be guaranteed by Eq. (|25p . This 



follows from a straightforward fact that the expression 
1 — 2/i(p_|_) — is nonpositive for p* < p+ < 1. Therefore 
no point with £,+ — ^ should satisfy Eq. (|3T|) . Because 
the slope of the line (IM)) is negative, it is sufficient to 
require that the point (^_ — = ^) is outside the 

allowed region. This is equivalent to the inequality: 

Wx +Wz > 1. (35) 

Further analysis depends on whether the point (^_ = 
i, — 1) is located within the allowed region of param- 
eters. It is easy to verify that this is determined by the 
relation between p^ and Wx ■ If p+ > Wx , this point sat- 
isfies Eq. (|3ip and the allowed region of parameters has 
the shape of a trapezoid, as shown in Fig. [IJa). Conse- 
quently, all values ^ < ^- < 1 are allowed. On the other 
hand, when p+ < Wx, the allowed region is a triangle, as 
depicted in Fig. Hfb) . The minimum allowed value of ^_ 
is then [wx — Wz)/{i- — Wz)- We can combine these two 
cases by defining 



= max 



1 



2' 1 



Wz 



(36) 



The maximization of /{£,-,£,+) over the line defined in 
Eq. p4p can now be written as a supremum over a single 
parameter: 



sup / ( 



1 



1 



1 



1 



(37) 



which inserted into Eq. ([55)1 yields the final form of the 
bound: 



Kd>1- 2h{p+) 



sup 

e""<«<i 



ii-p+)hiO+p+h 



Wz 



l + Wz 



(38) 

where p+ = (1 + Wz)/2. The results of a numerical eval- 
uation of the supremum are shown in Fig. ^a.). 

It is also possible to derive a slightly weaker bound 
that requires no numerical maximization, which we will 
denote as f'^'^^. Because the function /(^_,^+) is mono- 
tonic in each one of its two arguments, as discussed after 
Eq. ([55]) . we have 



ymax ^ 



(39) 



where i^™'" and are the smallest possible values of 
^_ and ^+ within the allowed region defined by Eqs. ((24|) 
and ([3T]) . The value i^™'" has been given explicitly in 
Eq. (P^ . while it is easy to verify that 



l + Wz 



(40) 



The simplified bound therefore takes the following ex- 
plicit form: 



Kd>1- 2h{p+) - (1 - p+)h (e'") ^p+hi- 



(41) 
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(a) p,> 



(b) < 



FIG. 2: The permitted region of the parameters used 
to maximize the function defined in Eq. (|32p . 




FIG. 3: The lower bound on the key as a function of and 
Wz obtained from (a) full optimization over the free parame- 
ters specified in Eq. (I38|l and (b) a weaker estimate according 
to Eq. (|41|l . The bound is positive in the shaded area, with 
solid contours drawn at steps 0.1 starting from 0. 



1 



W 



FIG. 4: The lower bound on the key given in Eq. (|43() obtained 
from observables w and Wz- The physical region is restricted 
to points (wjWz) satisfying the condition (1 + 'Wz)/2 > w. 
The coding of the bound value is the same as in Fig. [3] 



which is shown in Fig. [3jb) . 

Finally, let us note that the observable w defined in 
Eq. (jlSp can be combined with Wz to yield a stronger 
bound on the distillable key. To derive this bound, let us 
return to Eq. p5|) and estimate the last two terms on the 
right hand side. The inequality shown in Eq. (jl5p rewrit- 
ten in the new parametization provides a lower bound on 



1 



w 

2pT 



(42) 



Because the right hand side is greater or equal 1/2, we 
have < h{l/2 + w/2p+). Further, we obviously 

have /i(^„) < 1. This yields: 



Kd >p+[l-h (1/2 + w/2p+)] - 2h (p+) , 



(43) 



Let us note that physical values of w and Wz must satisfy 
the condition {1 + 'Wz)/2 > w, otherwise we would have 
P1+P2 = P+ = ii+'Wz)/2 < w < pi—p2 and consequently 
P2 < 0. In Fig. 13] we depict the bound (1^5]) in the physical 
region of w and Wz ■ 



V. DISCUSSION AND CONCLUSIONS 

In this paper we have introduced a privacy witness, i.e. 
an observable, whose mean value allows one to estimate 
nontrivially from below the amount of secret key, even in 
the case when the resulting state exhibits the separation 
of the secret key and the distillable entanglement. In fact 
this separation may be quite drastic while the witness is 
working perfectly. To see this let us take A'B' being 
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d ® d- level systems and consider a p-bit state qaba' B' in 
the form [9] 



QABA'B' 



2(P 



[(|oo)^B(oo| + |ii)^5(ii|)®i 



A'B' 



+ (|00)ab(11| + \ll)ABm)®VA' 



(44) 



where 1^' B' and Vk' B' stand respectively for bipartite 
identity and swap operator on the subsystems A' B' . 
In the limit of large d the distillable entanglement is 
bounded by vanishing log- negativity Eo < log2(l-l-4) 



0, while the privacy witness W = {a\ (c^ u g -r u ^^-^ u 
Va'B' gives us the value of lower bound Ku > 1 since 
w — TriyV QABA'B') — 1 and then just either of the 
weaker bounds given in Eqs. (PT|) or ([^ does the job. 
Note in particular that since the key part AB is a two 
qubit part the above estimate gives the maximum pos- 
sible value of the secret key Ku = logj 2 = 1 despite 
the fact that the distillable entanglement of the state is 
almost zero! 

In general the complexity of measuring the privacy wit- 
ness is related to the Hilbert-Schmidt decomposition of 
the hermitian operator U used to construct the witness 
p^ . In the case of the four qubit state that was stud- 
ied in the experiment reported in Ref. [8] the operator in 
question is the swap operator which is composed of three 
terms involving products of Pauli matrices: 

Va'B' - ^{iA'B'+^A'®^B'+^A''^^l'+^l''»^%')- (45) 

Taking into account the necessary measurements on the 
key part this gives in total 2x3 = 6 observables to be 
measured, each formed by a product of four Pauli matri- 
ces. This is dramatically less then the full tomography 
which requires 81 products of four Pauli matrices. Note 
that in some cases, like the p-bit state discussed above, 
such an apparently poor measurement has no problem 
in reporting the key value that lies above the distillable 
entanglement, which is bounded for our example by the 
log negativity value Ed^q) < log2(l -I- i) ~ 0.585. 

The above approach may be extended to higher dimen- 
sions and other twirling techniques may be applied. It 
may be especially useful when the experimentalist has a 
good guess about the expected p-bit he state in the labo- 
ratory then he or she may estimate the high key contents 
almost perfectly even if there is virtually no distillable 
entanglement in the system. Finally let us note that 
the very difficult problem is to find the nonlinear entan- 
glement witness that would capture collective behavior 
revealing the key in all the cases when any single-copy 
entropic fuction based on a one-way protocol fails. It 
seems that for this one needs quantum secrecy distilla- 
tion protocols of new generation. 

We believe that the present approach will lead to 
general and systematic development of experimentally 
friendly methods for detection and estimation of task- 
dedicated quantum entanglement and other resources. 
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Appendix A: Single witness bound 

Let us denote 
n{v+)=V+~'ih{p+)-p+h{{p+ + w)/2p+). (Al) 
The derivative with respect to p+ reads: 



dfv 1 , 
- — = - los 
dp+ 2 



p\{pX-w'^) 
(1-P+)^ ■ 



(A2) 



It is easy to see that on the interval w < p+ < 1 the 
argument of the logarithm function runs from to +00. 
Therefore k{p+) reaches its minimum at a root of a poly- 
nomial equation p\{p\ — uP') = (1 — P+)'^- This is a 
cubic equation which can be solved exactly, but a simpli- 
fied formula can be found by substituting p+ = w + 5 and 
assuming that (5 <^ 1 — w which is motivated by numerical 
analysis. This yields (5 « (1 — w)'^ /2w'^ and consequently 
the bound on the key in the approximate form 



2u;3 



(A3) 



This approximate expression turns out to reproduce the 
original bound quite tightly, as evidenced in Fig. [5] de- 
picting the difference between Eq. (|A3[) and the bound 
given in Eq. (|T9|) . 



FIG. 5: The difference between the bounds from Eqs. (fl^ 
and (|A3|I as a function of the parameter w. 
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